← Back

CVE-2024-8687

nvd nist
Published: Sep 11, 2024Modified: Jun 17, 2026

JSON object

Loading...
6.9
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber
Show more
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:AmberShow less
Source: psirt@paloaltonetworks.com (Secondary)

Description

An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.

Affected (13)

Paloaltonetworks
3 products
Pan Os
Globalprotect
Prisma Access
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Paloaltonetworks
Pan Os
From 10.0.0 to 10.0.12
Pan Os
From 10.1.0 to 10.1.9
Pan Os
From 10.2.0 to 10.2.4
Pan Os
From 8.1.0 to 8.1.25
Pan Os
From 9.0.0 to 9.0.17
Pan Os
From 9.1.0 to 9.1.16
Pan Os
Version 11.0.0
Configuration B
5 vulnerable
Vulnerable SoftwareAffected Versions
Paloaltonetworks
Globalprotect
From 5.1.0 to 5.1.12
Globalprotect
From 5.2.0 to 5.2.13
Globalprotect
From 6.0.0 to 6.0.7
Globalprotect
From 6.1.0 to 6.1.2
Globalprotect
Version 6.2.0
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Prisma Access
All versions
Running on/withPlatform Versions
Paloaltonetworks
Pan Os
Before 10.2.9

Related CWEs

CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

References (1)

Source: psirt@paloaltonetworks.com
Vendor Advisory

Timeline

No history available yet.